Uncovering Malware Families Using Convolutional Neural Networks (CNN)

Abstract

Malware attacks pose significant cyber threats, with a rising number of vulnerability reports in security communities due to the continual introduction of mutations by malware programmers to evade detection. One of the most attractive targets which attacked by malware is the organization emails system. Malware’s mutations within the malware family, has complicating the development of effective machine learning-based malware analysis and classification methods. To answer this challenge, this research uses an agnostic deep learning solution inspired by ImageNet's success, which efficiently classifies malware into families by analyzing visual representations of malicious software as greyscale images using a Convolutional Neural Network (CNN). The Malwizard is a flexible Python tool suitable for both organizations and end-users enabling automated and rapid malware analysis within email system. Malwizard could be use as an Outlook Email’s add-in and an API service for SOAR platforms. The study evaluates this novel approach using the Microsoft Classification Challenge dataset, where image representations are encrypted to address privacy concerns. Experimental results show that the proposed approach performs comparably to the best existing model on plain text data, accomplishing the task in one-third of the time. For the encrypted dataset, adjustments to classical techniques are necessary for improved efficiency.